Thursday, August 09, 2007

AWStats LogFormat

I just spent 6 hours trying to figure out why AWStats wasn't parsing our OHS (Oracle's version of Apache) logs anymore.
Try to spot the difference:
Jul 31 04:49:53 cluster1-3 apache[1234]: 123.123.123.132 - - [31/Jul/2007:04:53:17 -0400] "GET / HTTP/1.1" 200 269 "-" "Mozilla/4.0 (compatible; Windows NT 5.1) OracleEMAgentURLTiming/3.0"
Aug  1 04:49:53 cluster1-3 apache[1234]: 123.123.123.132 - - [01/Aug/2007:04:53:17 -0400] "GET / HTTP/1.1" 200 269 "-" "Mozilla/4.0 (compatible; Windows NT 5.1) OracleEMAgentURLTiming/3.0"

Answer: The second one has two spaces between the month and the date in the part that syslog writes. I had to change the LogSeparator variable from " " to " +" to match one or more spaces (actually I used "\s+" to be ultra safe since \s matches tabs too). You'll only have this problem if your apache output is going through syslog, which ours is since we're piping several server logs onto one computer.

No comments: